feat(ai-env): wire the TypeSafe key and enable Jev shadow gates

AI VM の apply.sh が Secret Manager の selfheal-typesafe-api-key を取得し、
agent コンテナに JEV_KEY_FILE として渡す。ai.env で JEV_MODE=shadow、
JEV_MODEL=jev-1.13.0 を設定し、鍵が未登録でも agent は通常どおり動く
（ゲートは鍵未登録を記録するだけ）。

vm/ai-env/apply.sh

@@ -20,11 +20,12 @@ SEC=/opt/selfheal/ai/secrets
 mkdir -p "$SEC"; chmod 700 /opt/selfheal/ai "$SEC"
 umask 077
 secret selfheal-openai-api-key    > "$SEC/openai-api-key"
+secret selfheal-typesafe-api-key  > "$SEC/typesafe-api-key"
 secret selfheal-discord-bot-token > "$SEC/discord-bot-token"
 secret selfheal-k8s-ai-token      > "$SEC/k8s-token"
 secret selfheal-k8s-ca-cert       > "$SEC/k8s-ca.crt"
 unset TOKEN
-for f in openai-api-key discord-bot-token; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
+for f in openai-api-key discord-bot-token typesafe-api-key; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
 for f in k8s-token k8s-ca.crt; do [ -s "$SEC/$f" ] || echo "note: $f is empty (run make token on the operator host)" >&2; done
 chown -R 10002:10002 "$SEC"; chmod 600 "$SEC"/*   # agent/hitl run as uid 10002